ahmyth | ROPanel-FF-v4[.]apk

General

Target

ROPanel-FF-v4.apk
Size

37.4MB
MD5

848920df47508f0316be22ac51ac88e5
SHA1

44c65cb043c4485e6fedb1123a2ab0f11c24b8d8
SHA256

7daef80bc7cd3ec6303ffd1e07d06982431b2c29685fbf9f95367a9ad4521b2f
SHA512

dcc1ef0559e7c7c01ba4b5e3d87f7cbac9ec2a113761c2d0bd081d8834f71fa809d27857c2d64735769c093b2e4137f5aa23547c977bb0ae53dd01c855674f23
SSDEEP

786432:MHVEVNWex9coTFuIPFd1VDUCBITOMWePBy4yUCXJ6PwCBL7n4x9G/d54:WEHRx2oMAd1VNpMWePByjJ6Pfnn47454

Score

10^/10

ahmyth

Malware Config

Extracted

Family

ahmyth

C2

http://147.185.221.17:25603

Signatures

Ahmyth family
ahmyth

Requests dangerous framework permissions 20 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Files

ROPanel-FF-v4.apk
.apk android

com.jatodoshackers.returnsffh4v137

.MainActivity

Activities

.MainActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.INTERNET
android.permission.REQUEST_DELETE_PACKAGES
android.permission.DELETE_PACKAGES
android.permission.DELETE_CACHE_FILES
android.permission.SET_WALLPAPER
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_BROADCAST_RADIO
android.permission.BROADCAST_SMS
android.permission.BROADCAST_PACKAGE_REMOVED
android.permission.BROADCAST_NETWORK_PRIVILEGED
android.permission.BROADCAST_STICKY
android.permission.BROADCAST_WAP_PUSH
android.permission.MODIFY_CELL_BROADCASTS
android.permission.RECEIVE_EMERGENCY_BROADCAST
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.INSTALL_PACKAGES
android.permission.GET_PACKAGE_SIZE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
android.permission.CAMERA
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.WRITE_SETTINGS
android.permission.WRITE_SECURE_SETTINGS
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.READ_CALL_LOG
android.permission.PROCESS_OUTGOING_CALLS
android.permission.READ_CONTACTS
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.REQUEST_IGNORE_BATTERY_OPTIMISATIONS

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

ahmyth.mine.king.ahmyth.MyReceiver

android.intent.action.BOOT_COMPLETED

Services

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

Android Permissions

ROPanel-FF-v4.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.INTERNET

android.permission.REQUEST_DELETE_PACKAGES

android.permission.DELETE_PACKAGES

android.permission.DELETE_CACHE_FILES

android.permission.SET_WALLPAPER

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_BROADCAST_RADIO

android.permission.BROADCAST_SMS

android.permission.BROADCAST_PACKAGE_REMOVED

android.permission.BROADCAST_NETWORK_PRIVILEGED

android.permission.BROADCAST_STICKY

android.permission.BROADCAST_WAP_PUSH

android.permission.MODIFY_CELL_BROADCASTS

android.permission.RECEIVE_EMERGENCY_BROADCAST

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.INSTALL_PACKAGES

android.permission.GET_PACKAGE_SIZE

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

android.permission.CAMERA

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.READ_CALL_LOG

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_CONTACTS

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.REQUEST_IGNORE_BATTERY_OPTIMISATIONS

Sharing

General

Malware Config

Extracted

Signatures

Files

com.jatodoshackers.returnsffh4v137

.MainActivity

Activities

.MainActivity

Permissions

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

ahmyth.mine.king.ahmyth.MyReceiver

Services

com.google.firebase.messaging.FirebaseMessagingService

Android Permissions

ROPanel-FF-v4.apk